CVE-2026-73671: Saurus CMS Community Edition

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

Saurus CMS Community Edition contains an unauthenticated open redirect vulnerability in the logout handling code in classes/port.inc.php, where the url parameter supplied via GET or POST is passed directly to the Location header without domain allowlist, scheme validation, or relative path enforcement. Attackers can craft a malicious logout URL containing an arbitrary external domain or javascript: URI scheme to redirect authenticated users to attacker-controlled phishing pages after session destruction, enabling credential theft and OAuth redirect abuse.

Affected products

• Saurus Saurus CMS Community Edition: up to and including d886e5b

Published 2026-08-13. Last modified 2026-08-31.